From f205b36b72466c9a687ffab330aa3fdfc9a84a7f Mon Sep 17 00:00:00 2001 From: cad-safe-bot Date: Sat, 1 Jun 2024 06:03:22 +0000 Subject: [PATCH] Auto-Update: 2024-06-01T06:00:30.048267+00:00 --- CVE-2023/CVE-2023-63xx/CVE-2023-6382.json | 55 +++++++++++++++++++++++ CVE-2024/CVE-2024-35xx/CVE-2024-3564.json | 47 +++++++++++++++++++ CVE-2024/CVE-2024-35xx/CVE-2024-3565.json | 51 +++++++++++++++++++++ README.md | 13 +++--- _state.csv | 7 ++- 5 files changed, 165 insertions(+), 8 deletions(-) create mode 100644 CVE-2023/CVE-2023-63xx/CVE-2023-6382.json create mode 100644 CVE-2024/CVE-2024-35xx/CVE-2024-3564.json create mode 100644 CVE-2024/CVE-2024-35xx/CVE-2024-3565.json diff --git a/CVE-2023/CVE-2023-63xx/CVE-2023-6382.json b/CVE-2023/CVE-2023-63xx/CVE-2023-6382.json new file mode 100644 index 00000000000..d2a56ec0bdb --- /dev/null +++ b/CVE-2023/CVE-2023-63xx/CVE-2023-6382.json @@ -0,0 +1,55 @@ +{ + "id": "CVE-2023-6382", + "sourceIdentifier": "security@wordfence.com", + "published": "2024-06-01T05:15:08.287", + "lastModified": "2024-06-01T05:15:08.287", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "The Master Slider \u2013 Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_slide' shortcode in all versions up to, and including, 3.9.9 due to insufficient input sanitization and output escaping on user supplied 'css_class' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security@wordfence.com", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 6.4, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 3.1, + "impactScore": 2.7 + } + ] + }, + "references": [ + { + "url": "https://plugins.trac.wordpress.org/browser/master-slider/trunk/includes/msp-shortcodes.php#L55", + "source": "security@wordfence.com" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3065917%40master-slider&new=3065917%40master-slider&sfp_email=&sfph_mail=", + "source": "security@wordfence.com" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3084860%40master-slider&new=3084860%40master-slider&sfp_email=&sfph_mail=", + "source": "security@wordfence.com" + }, + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2d2fc926-6f9f-4ed9-9598-e39b5e6c6544?source=cve", + "source": "security@wordfence.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-35xx/CVE-2024-3564.json b/CVE-2024/CVE-2024-35xx/CVE-2024-3564.json new file mode 100644 index 00000000000..5e268870aad --- /dev/null +++ b/CVE-2024/CVE-2024-35xx/CVE-2024-3564.json @@ -0,0 +1,47 @@ +{ + "id": "CVE-2024-3564", + "sourceIdentifier": "security@wordfence.com", + "published": "2024-06-01T04:15:08.743", + "lastModified": "2024-06-01T04:15:08.743", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the plugin's 'content_block' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security@wordfence.com", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "UNCHANGED", + "confidentialityImpact": "HIGH", + "integrityImpact": "HIGH", + "availabilityImpact": "HIGH", + "baseScore": 8.8, + "baseSeverity": "HIGH" + }, + "exploitabilityScore": 2.8, + "impactScore": 5.9 + } + ] + }, + "references": [ + { + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3078739%40custom-post-widget&new=3078739%40custom-post-widget&sfp_email=&sfph_mail=", + "source": "security@wordfence.com" + }, + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c5a0b8fe-d284-4780-84b5-2e97fa96c99a?source=cve", + "source": "security@wordfence.com" + } + ] +} \ No newline at end of file diff --git a/CVE-2024/CVE-2024-35xx/CVE-2024-3565.json b/CVE-2024/CVE-2024-35xx/CVE-2024-3565.json new file mode 100644 index 00000000000..9641df0f8ae --- /dev/null +++ b/CVE-2024/CVE-2024-35xx/CVE-2024-3565.json @@ -0,0 +1,51 @@ +{ + "id": "CVE-2024-3565", + "sourceIdentifier": "security@wordfence.com", + "published": "2024-06-01T04:15:09.000", + "lastModified": "2024-06-01T04:15:09.000", + "vulnStatus": "Received", + "descriptions": [ + { + "lang": "en", + "value": "The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_block' shortcode in all versions up to, and including, 3.3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page." + } + ], + "metrics": { + "cvssMetricV31": [ + { + "source": "security@wordfence.com", + "type": "Primary", + "cvssData": { + "version": "3.1", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", + "attackVector": "NETWORK", + "attackComplexity": "LOW", + "privilegesRequired": "LOW", + "userInteraction": "NONE", + "scope": "CHANGED", + "confidentialityImpact": "LOW", + "integrityImpact": "LOW", + "availabilityImpact": "NONE", + "baseScore": 6.4, + "baseSeverity": "MEDIUM" + }, + "exploitabilityScore": 3.1, + "impactScore": 2.7 + } + ] + }, + "references": [ + { + "url": "https://plugins.trac.wordpress.org/browser/custom-post-widget/trunk/shortcode.php#L62", + "source": "security@wordfence.com" + }, + { + "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3078739%40custom-post-widget&new=3078739%40custom-post-widget&sfp_email=&sfph_mail=#file6", + "source": "security@wordfence.com" + }, + { + "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/16d8eab2-953a-46bf-a0f6-296bcea86305?source=cve", + "source": "security@wordfence.com" + } + ] +} \ No newline at end of file diff --git a/README.md b/README.md index ff2041f2a26..8c402b69283 100644 --- a/README.md +++ b/README.md @@ -13,13 +13,13 @@ Repository synchronizes with the NVD every 2 hours. ### Last Repository Update ```plain -2024-06-01T04:00:37.505560+00:00 +2024-06-01T06:00:30.048267+00:00 ``` ### Most recent CVE Modification Timestamp synchronized with NVD ```plain -2024-06-01T03:15:08.413000+00:00 +2024-06-01T05:15:08.287000+00:00 ``` ### Last Data Feed Release @@ -33,15 +33,16 @@ Download and Changelog: [Click](https://github.com/fkie-cad/nvd-json-data-feeds/ ### Total Number of included CVEs ```plain -252346 +252349 ``` ### CVEs added in the last Commit -Recently added CVEs: `2` +Recently added CVEs: `3` -- [CVE-2024-2933](CVE-2024/CVE-2024-29xx/CVE-2024-2933.json) (`2024-06-01T02:15:47.727`) -- [CVE-2024-4711](CVE-2024/CVE-2024-47xx/CVE-2024-4711.json) (`2024-06-01T03:15:08.413`) +- [CVE-2023-6382](CVE-2023/CVE-2023-63xx/CVE-2023-6382.json) (`2024-06-01T05:15:08.287`) +- [CVE-2024-3564](CVE-2024/CVE-2024-35xx/CVE-2024-3564.json) (`2024-06-01T04:15:08.743`) +- [CVE-2024-3565](CVE-2024/CVE-2024-35xx/CVE-2024-3565.json) (`2024-06-01T04:15:09.000`) ### CVEs modified in the last Commit diff --git a/_state.csv b/_state.csv index 29f76c3a455..f1673d6bc87 100644 --- a/_state.csv +++ b/_state.csv @@ -239441,6 +239441,7 @@ CVE-2023-6378,0,0,4e5c95a250705e0dd6a8bbc06b93d64ed77669aa10d8e08cf26322a24f2351 CVE-2023-6379,0,0,b7a577bc70f83785aa29bf1c30ba879dfd82bc67d666c7986d31270d7af1419f,2023-12-15T20:33:49.850000 CVE-2023-6380,0,0,392e06acbd089517e78f47acec46283d5c2952e9063d6ec241117f7f2010ba21,2023-12-15T20:22:40.343000 CVE-2023-6381,0,0,9eb2cc86268893afb53ecfd36bf1545e56605f2230eb1c628f554cc9d2441ca9,2023-12-18T19:58:19.327000 +CVE-2023-6382,1,1,e0db7620db06593734acbcf41a0f8895a043ff10f17fcf8765faabded5015f98,2024-06-01T05:15:08.287000 CVE-2023-6383,0,0,eac1f58249c44013eaf9187ffa2f61b6b9c7a5a7e3f599e1a3d52dda8bd10105,2024-01-11T20:02:29.963000 CVE-2023-6384,0,0,e42c9ea468164d3f1395963798a71fe4d69d29c0523c49e6e6b388cfb04d28f8,2024-01-26T19:41:47.807000 CVE-2023-6385,0,0,049ae674d4d43f272c3f927a467a05302d852711996c1c33eaa10b46d553ec9f,2024-04-10T13:23:38.787000 @@ -247480,7 +247481,7 @@ CVE-2024-2931,0,0,a6d520754016bbdab2d7efa74efc39e3254a7b8cd183192dc94878921c91c9 CVE-2024-29316,0,0,a77a66080b82cffb666cc5dc96a72ca9eacad7eb3c1a78f29a15ae578e7a1db4,2024-03-29T12:45:02.937000 CVE-2024-2932,0,0,a3c1266ff6f47dc95aa30613f077416ccee7f436989a8ec80d1c9241ff3cefc9,2024-05-17T02:38:37.813000 CVE-2024-29320,0,0,321a08ec2af8156a6831bdc4e0f91613cac88682c2798c2c52128b513367591a,2024-04-30T17:52:35.057000 -CVE-2024-2933,1,1,a9f810664b426fd297cd6d80897c2d20b389d40ce702149828bd398ef7bb339d,2024-06-01T02:15:47.727000 +CVE-2024-2933,0,0,a9f810664b426fd297cd6d80897c2d20b389d40ce702149828bd398ef7bb339d,2024-06-01T02:15:47.727000 CVE-2024-29338,0,0,e2411b46399ccf809f7042628f5dc80681cab752a4fc33bfa69d55d7b188c619,2024-03-22T19:02:10.300000 CVE-2024-2934,0,0,3802ca621262b108954a2e7ca078a0b3239a058a100ed0a90d89e0faae5d736e,2024-05-17T02:38:37.907000 CVE-2024-2935,0,0,bec21ac61474c1b8576f1b42d537e6fe78cbe9ea3670df60a6cb2385d6dc491a,2024-05-17T02:38:38.003000 @@ -250775,6 +250776,8 @@ CVE-2024-3560,0,0,66c1a96b1f1d19ab8c2a91f30bb939a8ccde028ecd6951f27029cb1628de4d CVE-2024-35618,0,0,f4a659269990a7da5fc8a683283ab4936f111dc8d0577fd89324aa0b32252657,2024-05-24T18:09:20.027000 CVE-2024-35621,0,0,359bbde00ddda9bcf647c6b7e008c50b5044b1ab7e2482e3d77bfaec39975360,2024-05-28T17:11:47.007000 CVE-2024-35627,0,0,152f6a140367536a1e62d9a33b0213a3c0edb39ccbba33db112f0915411e954b,2024-05-24T01:15:30.977000 +CVE-2024-3564,1,1,126b0ad745c05ac2b6e0879d574d7c57b3c5395a16548c8e712a48ce4bee21ab,2024-06-01T04:15:08.743000 +CVE-2024-3565,1,1,e1b2000c5686d2ca445ed687220d6569396d5c02fc079146ba9e31752c24516d,2024-06-01T04:15:09 CVE-2024-3566,0,0,e417ef1ceca67d3a9a8ba800520d4a9974bcf4eba2e3e6325dafdfbfe6af8d6b,2024-04-10T19:49:51.183000 CVE-2024-3567,0,0,20839fe5058050b88e3eab46e96c3f4983a4ed5d3b8a31d734ec6d77ca524853,2024-04-10T19:49:51.183000 CVE-2024-3568,0,0,573133d2a7191a46b0975280ef7162f7787321191e0ad33f2c4c70c7e8d9c3f5,2024-04-10T19:49:51.183000 @@ -251939,7 +251942,7 @@ CVE-2024-4702,0,0,391d02c5718dd442c026ca8f3973c4fe10894f8eeb54175158dc44cd7ef50d CVE-2024-4706,0,0,a959e13293b1a5966007eb60c79cb973f34e4d1d8bd1c12986cac54d81ac9a3d,2024-05-24T01:15:30.977000 CVE-2024-4709,0,0,c27b22c30c2569acd5c758eb82bd584c5ae09da5862ed28e288bc8b8f592259a,2024-05-20T13:00:34.807000 CVE-2024-4710,0,0,500a7d3af356181a474ebd9523b50fd3ae653f9a07ad01e5b7699589bd4ccc5d,2024-05-21T12:37:59.687000 -CVE-2024-4711,1,1,3a11a9a87549fa06b3be5f3ee9634f6d1a64361088dba0c9e99ac1ad3898af7e,2024-06-01T03:15:08.413000 +CVE-2024-4711,0,0,3a11a9a87549fa06b3be5f3ee9634f6d1a64361088dba0c9e99ac1ad3898af7e,2024-06-01T03:15:08.413000 CVE-2024-4712,0,0,f79d5936efdb7279077ea6da35ae307312c55a147f3075b5570853347f8017b9,2024-05-14T16:11:39.510000 CVE-2024-4713,0,0,63c8fe02e071c01e10e60f543cd0776ed83adea75c2d063179e2f75e75c30c3b,2024-05-17T02:40:33.880000 CVE-2024-4714,0,0,4e7ff77f8284c93c8758bb989744763ec5c4cb8551eeb8d726beabface4981b3,2024-05-17T02:40:33.983000